Re: [PATCH] connscheduler.cgi: Remove cleanhtml command from Remark

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2775 bytes --]

Hello Adolf,

I believe that I cannot merge these patches.

The reason simply is that it would create a store cross-site scripting attack vector because someone could store some <script> tags with some JS which will be executed if another admin opens the same page.

That is why we escape the content so that if there are any special characters like <> for HTML tags they won’t be interpreted by the browser.

We might have problems where we accidentally call the cleanhtml function twice which should show garbage. We might also have a problem where the function is not giving us the output that we want.

Which strings have been causing problems? Just German umlauts like “äöü”?

-Michael

> On 5 Mar 2024, at 19:44, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
> 
> - Using cleanhtml on Remarks means that all characters with diacritical marks such as
>   umlauts or grave accents etc get encoded into other characters.
> - If Freifunk München e.V. is entered as a remark it gets converted to
>   Freifunk München e.V.
> - cleanhtml is only removed from Remarks or Comment fields. In other places it has been
>   left in place.
> 
> Tested-by: Adolf Belka <adolf.belka(a)ipfire.org>
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
> html/cgi-bin/connscheduler.cgi | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/html/cgi-bin/connscheduler.cgi b/html/cgi-bin/connscheduler.cgi
> index cc78cbc1b..817247cc4 100644
> --- a/html/cgi-bin/connscheduler.cgi
> +++ b/html/cgi-bin/connscheduler.cgi
> @@ -2,7 +2,7 @@
> ###############################################################################
> #                                                                             #
> # IPFire.org - A linux based firewall                                         #
> -# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
> +# Copyright (C) 2007-2024  IPFire Team  <info(a)ipfire.org>                     #
> #                                                                             #
> # This program is free software: you can redistribute it and/or modify        #
> # it under the terms of the GNU General Public License as published by        #
> @@ -186,7 +186,7 @@ if ( ($cgiparams{'ACTION'} eq 'add') || ($cgiparams{'ACTION'} eq 'update') )
>   $CONNSCHED::config[$i]{'DAYSTYPE'} = lc($cgiparams{'ACTION_DAYSTYPE'});
>   $CONNSCHED::config[$i]{'DAYS'} = $l_days;
>   $CONNSCHED::config[$i]{'WEEKDAYS'} = $l_weekdays;
> -  $CONNSCHED::config[$i]{'COMMENT'} = &Header::cleanhtml($cgiparams{'ACTION_COMMENT'});
> +  $CONNSCHED::config[$i]{'COMMENT'} = $cgiparams{'ACTION_COMMENT'};
> 
>   &CONNSCHED::WriteConfig;
> }
> -- 
> 2.44.0
>